Use function calling for isolated tool actions where the model sends structured parameters, the application runs one named function, and the result returns for review. Use code mode for multi-step workflows that involve chaining tools, running loops, and processing intermediate data inside a sandbox.
The comparison comes down to five factors:
-
Direct tool-call visibility: Function calling exposes each request and result, making individual actions easier to validate, authorize, and review.
-
Sandboxed program execution: Code mode runs model-generated orchestration code inside a restricted environment with controlled permissions and resource limits.
-
On-demand tool discovery: Code mode loads only the tool definitions required for the task, rather than loading the entire catalog into the model’s context.
-
In-environment data processing: Code mode filters, transforms, or aggregates intermediate results before returning the required output to the model.
-
Workflow-specific benchmarking: Teams should compare both patterns on the same tasks because token, latency, and reliability gains depend on workflow complexity.
| Factor | Function calling | Code mode |
|---|---|---|
| Tool-call visibility | Each request and result is exposed for validation | Orchestration runs inside a sandbox; only selected results return |
| Who decides the next step | The model, after inspecting each result | Program logic, through loops and conditions |
| Tool definitions loaded | Typically the full schema for every available tool | Only the definitions the task needs, discovered on demand |
| Intermediate data | Returned to the model in full | Filtered, transformed, or aggregated before returning |
| Best-fit workflow | Short, judgment-heavy, or approval-sensitive actions | Multi-step, repeatable orchestration with loops and conditions |
Below, we compare the mechanics, published benchmarks, security costs, and best-fit workflows for both function calling and code mode.
How should engineers choose between code mode and function calling?
The choice comes down to where the orchestration logic should run. Use function calling when the model needs to inspect each result before deciding what happens next. Use code mode when a repeatable sequence can run as program logic without returning every intermediate result to the model.
This choice changes how tools are invoked, not what those tools know. The Atlan MCP Server, built the same way teams approach building MCP servers for enterprise data generally, can deliver governed, policy-scoped context from Atlan’s Context Lakehouse to either approach. Both can therefore use the same approved definitions, ownership, lineage, and access rules from Atlan’s Context Layer for AI.
Engineers can make the decision by answering five questions:
| Decision question | Choose function calling when | Choose code mode when |
|---|---|---|
| How many dependent calls are required? | The task needs one action or a short sequence | The task needs repeated calls, loops, or a longer tool chain |
| Who should decide the next step? | The model must interpret each result before continuing | Program logic can handle the next step through conditions or loops |
| How much intermediate data is produced? | Each result is small and useful to the model | Large results can be filtered, transformed, or aggregated before returning |
| Where is review required? | Each tool call needs separate validation or approval | Review can focus on the generated code and selected sensitive actions |
| What execution infrastructure can the team support? | A tool dispatcher and schema validation are sufficient | The team can operate a secure sandbox with limits, monitoring, and logs |
This choice is narrower than deciding between MCP and function calling or MCP and a direct API integration. Those decisions determine how tools are exposed and connected in the first place, which is why MCP matters for AI agents at all. Code mode versus function calling determines how the agent executes them.
Most production agents can use both. Function calling can handle approval-sensitive writes and steps requiring model judgment, while code mode handles bounded, repetitive, or data-heavy parts of the workflow.
How does function calling work?
Function calling keeps the model inside the orchestration loop. At each step, the model selects a named tool and produces structured arguments for it. The application validates those arguments, executes the function, and returns the result to the model. The model then interprets the result and decides whether to call another tool, produce an answer, or stop.
This sequence is the basic form of tool use in AI agents and one of the core AI agent primitives. It’s also the mechanism most AI agent skills packages rely on when they expose one defined action instead of an open-ended MCP connection. Because every call passes through the application, the agent harness gets a clear control point around each action. It can validate the request, check authorization, require approval before a sensitive write, and record the result.
This approach fits an AI agent architecture in which each observation may change the model’s next decision. For example, the model can inspect an API error, revise its arguments, and retry the call instead of continuing with a fixed sequence.
The trade-off is that every intermediate result is returned to the model. In Anthropic’s code execution with MCP example, a Google Drive transcript is added to the model context and must then be reproduced in a Salesforce tool call. Anthropic estimates that moving a two-hour meeting transcript this way could add 50,000 tokens because the complete transcript passes through the model twice.
This overhead grows with the size of tool results and the number of dependent calls. Function calling remains useful when the model must evaluate each result, but it becomes less efficient when the model is only forwarding, filtering, or aggregating data that program logic could process directly.
How does code mode work?
Code mode moves repeatable orchestration out of the model loop and into a program. The model writes code against a typed tool API, and a restricted execution environment runs it, keeping intermediate results outside the model’s context.
In practice, code mode follows four steps:
-
Discover relevant tools: The runtime lets the model search for the tool definitions it needs instead of loading every complete schema into its context, the same discovery problem an agent registry and an MCP registry solve at the fleet level rather than the single-call level.
-
Generate a program: The model combines tool calls with loops, conditions, filtering, and error handling.
-
Execute inside a sandbox: The runtime applies limits to permissions, memory, time, filesystem, and network.
-
Return selected results: The program processes intermediate data and returns only the information the model needs.
This approach reduces the tokens consumed by tool definitions and intermediate results. Anthropic reports that loading tool definitions on demand reduced the size of one example from 150,000 tokens to 2,000 tokens, a 98.7% reduction. These savings become most significant when agents work with large tool catalogs, long tool chains, or data-heavy workflows.
Cloudflare’s Code Mode implementation exposes search() and execute() over the same Model Context Protocol foundation Anthropic uses for direct tool calls, and runs the generated JavaScript in a V8 isolate. Luuk Hofman, Solutions Engineer at Cloudflare, summarized the design in InfoQ’s 2026 coverage: “convert MCP tools into a TypeScript API and just ask the LLM to write code against it.”
In Cloudflare’s implementation, the V8 isolate has no filesystem or environment variables, blocks outbound network access by default, and reaches connected services only through explicit bindings. API credentials remain outside the sandbox, limiting the impact of faulty or malicious code.
The sandbox belongs inside the agent harness engineering layer. Engineers learning what harness engineering is should also distinguish an agent harness from an agent framework: the framework provides development abstractions, while the harness controls execution, permissions, state, and evidence.
Isolation reduces the attack surface, but it does not remove the need for security controls. A practical guide to building an AI agent harness should combine sandboxing with scoped permissions, resource limits, approval gates, and monitoring. Teams should also test the agent harness against runaway loops, blocked access, malformed code, partial writes, and approval pauses.
What do the code mode benchmarks actually show?
Anthropic and Cloudflare report substantial context savings, but their figures measure different aspects of code mode and are not based on controlled head-to-head benchmarks. Anthropic measures the effect of loading tool definitions on demand, while Cloudflare measures the input-token footprint of exposing a large API.
The defensible comparison is:
| Source and year | Scenario | Reported result | What it establishes | What it does not establish |
|---|---|---|---|---|
| Anthropic, 2025 | Tool definitions loaded on demand | Token usage fell from 150,000 to 2,000, a 98.7% reduction | On-demand discovery can substantially reduce context usage in a large tool environment | The savings available for every task, model, or tool stack |
| Cloudflare, 2026 | More than 2,500 API endpoints exposed through two tools | Input-token usage fell from 1.17 million to about 1,000, a 99.9% reduction | Progressive discovery can expose a large API without loading every schema | End-to-end task latency, cost, success rate, or answer quality |
These are vendor-reported measurements from different implementations. Anthropic does not provide a controlled benchmark suite covering multiple models, tasks, or execution environments. Cloudflare’s result measures the initial tool-definition footprint, not the total tokens consumed while completing a workflow.
MarkTechPost’s technical summary explains Anthropic’s scenario but does not independently reproduce the result. Simon Willison, independent open-source developer and creator of Datasette, called the approach “a sensible way to take advantage of the strengths of coding agents” in his November 2025 analysis.
Neither source provides a controlled end-to-end latency benchmark or supports a general 30% to 40% latency reduction. Code mode can avoid intermediate model round trips, but tool discovery, code generation, sandbox execution, retries, and approvals can add overhead. Teams should compare the two patterns for the same tasks and measure total token usage, latency, cost, success rate, retries, and review effort.
As with the choice between ReAct and plan-and-execute, performance depends on the task shape and where model reasoning is required, not solely on the pattern’s name.
When should engineers choose function calling?
Function calling is the better choice when a workflow consists of short, predictable actions and the application needs to inspect, validate, or approve each tool call separately. It also avoids the operational overhead of running model-generated programs inside a general-purpose sandbox.
The strongest use cases include:
-
Single-step actions: Fetch one record, create one ticket, update one field, or send one approved message through a named tool, the same scope where agent skills differ from raw tools in packaging.
-
Frequent judgment points: Return each result to the model when it must interpret the output before deciding what to do next.
-
Sensitive actions: Expose the tool name and arguments to the application or a human reviewer before executing writes, payments, deletions, or permission changes.
-
Audit-heavy workflows: Record each request and response as a separate event when reviewers need a clear trace of the agent’s intermediate steps.
-
Low sandboxing tolerance: Use direct tool calls when the organization cannot yet secure, monitor, and operate an environment for model-generated code.
Function calls can consume more tokens in long workflows because every intermediate result is returned to the model. For short or approval-sensitive tasks, however, the additional context cost may be a reasonable tradeoff for simpler execution and more granular oversight.
When should engineers choose code mode?
Code mode is the better choice when a workflow contains repeatable orchestration that can run as program logic without returning every intermediate result to the model. It works particularly well when the agent must coordinate many tool calls or process large amounts of data inside a sandbox.
The strongest use cases include:
-
Long tool chains: Execute several dependent calls in one program, including passing the output of one tool directly into another.
-
Loops and repeated calls: Paginate through an API, poll for completion, or apply the same operation across many records without another model turn for each call.
-
Conditional processing: Use branches, validation rules, and error handling to respond to structured values inside the execution environment.
-
Large intermediate results: Filter, join, aggregate, or redact data within the sandbox, returning only the information the model needs.
-
Large tool catalogs: Discover and load only the relevant tool definitions instead of placing every available schema in the model context.
Code mode is most effective when the mechanical parts of the workflow are stable and repeatable. Decisions that require business interpretation, ambiguous reasoning, or human approval should still be routed back to the model or application rather than remain buried in generated code.
These workflows also introduce familiar agent harness failure patterns, such as uncontrolled loops, weak timeouts, broad credentials, and partial writes. The selected agent harness tools must enforce resource limits, permission boundaries, execution logs, and recovery controls, the same ground covered by dedicated AI guardrail tools built specifically for policy enforcement.
Code mode improves tool orchestration within an agent, but it does not determine whether the wider system should use a single-agent or multi-agent architecture. Workflows spanning independent agents still require deliberate multi-agent coordination patterns and shared context management, and when a sandboxed program misbehaves inside one of those agents, debugging multi-agent systems means correlating its generated code with the coordination layer above it.
What do code mode and function calling leave unresolved?
Code mode and function calling determine how an agent invokes a tool. Neither determines whether the tool returns the correct business definition, uses current data, respects the requester’s permissions, or provides evidence traceable to its source.
Consider an agent asked to calculate revenue across several business units. Function calling may expose every step, whereas code mode may complete the workflow within a single sandboxed program. But neither pattern can identify the approved revenue definition, the authoritative tables, or the regional access rules unless the tool endpoint supplies that context.
Atlan sits behind either invocation path as the Context Layer for AI, delivering the kind of shared grounding how MCP delivers business context describes more generally. It makes business meaning, ownership, quality signals, policy context, and lineage available through a shared endpoint, whether that endpoint takes the shape of the Atlan MCP Server for Salesforce or a hand-built API, so each agent does not have to reconstruct that understanding independently.
The requirements left unresolved by invocation mechanics map to Atlan’s capabilities as follows:
| What the invocation pattern cannot determine | Atlan capability | How Atlan addresses the gap |
|---|---|---|
| Whether the tool uses the approved business meaning and policy context | Atlan MCP Server and Context Lakehouse | Delivers the same definitions, ownership, and policy-scoped context to function calls and code-mode programs |
| Whether the underlying data is fit for use | Context Agents, including Vera for data quality | Surfaces completeness, accuracy, and freshness signals before an agent uses an asset |
| Where the returned data came from and what depends on it | Data Lineage | Maps column-level relationships from SQL, pipelines, and BI models so teams can investigate sources, transformations, and downstream impact |
| Whether the context has been tested and improved for agent use | Context Engineering Studio | Supports the build, test, review, approval, deployment, and observation of versioned context repositories |
This distinction is especially important for code mode. A sandbox controls what a generated program can access and execute. Atlan controls the meaning, quality, permissions, and provenance of the context that the program receives.
Data Lineage and runtime observability also answer different questions. Lineage explains how the underlying data moved and changed across systems. Context Engineering Studio traces show how an agent retrieved and applied that context during a specific interaction. Together, they help teams investigate both a questionable source and the agent behavior that turned it into an answer.
How should teams benchmark code mode against function calling?
Benchmark both patterns on completed tasks, not isolated tool calls or vendor-reported token reductions. Use the same model, tool interfaces, data, permissions, and success criteria, so that the invocation pattern is the only variable being tested.
Run the comparison in this order:
-
Choose a representative task: Select a workflow with a known outcome, multiple tool calls, approval points, and clearly defined failure conditions.
-
Build comparable implementations: Run the complete workflow with function calling, then move a bounded, repetitive part of the same workflow into code mode.
-
Test normal and failure cases: Include successful calls, malformed responses, timeouts, permission denials, partial writes, and unavailable tools.
-
Measure the complete workload: Compare total token usage, end-to-end latency, task success, retries, sandbox costs, and human review time.
-
Inspect the execution evidence: Confirm that generated code, tool calls, approvals, policy decisions, data sources, and final outputs can be reconstructed.
-
Check answer trust: Verify that both implementations use the same approved definitions, permission boundaries, and current sources.
-
Keep the boundary that performs best: Use function calling for steps requiring model judgment or approval, and code mode for bounded orchestration that benefits from loops and in-environment processing.
One pattern does not have to control the entire workflow. The most effective production design may combine direct function calls for sensitive decisions with code mode for repeatable, data-heavy processing.
If context quality, permissions, or traceability remain the limiting factors, book a demo to see how Atlan can provide shared, governed context to either invocation pattern.
FAQs about code mode vs. function calling
1. Is code mode the same thing as MCP?
No. MCP standardizes how AI applications connect to tools and context, while code mode lets a model compose tool calls by writing a program. Anthropic and Cloudflare use code mode with MCP, but MCP also supports direct tool calls.
2. Does code mode work with models other than Claude, including OpenAI models?
It can. Code mode is a runtime pattern, so an OpenAI or other model can use it if the host supports code generation, sandboxed execution, and access to the required tools.
3. When should you use function calling instead of code mode?
Use function calling for single actions, short sequences, sensitive operations, and workflows where the model or a person must review each result. It avoids the infrastructure required to execute model-generated code.
4. Is it safe to let a model write and execute its own code?
Only inside a restricted sandbox. The runtime should block ambient filesystem, environment, and network access, expose only approved tools, enforce resource limits, keep credentials outside generated code, and require approval for sensitive actions.
5. Do the reported 98.7% and 99.9% token savings apply to every workflow?
No. Anthropic’s 98.7% result came from loading tool definitions on demand, while Cloudflare’s 99.9% result measured the input-token footprint of exposing more than 2,500 API endpoints. Neither figure represents a universal reduction in total task cost or latency.
6. Can code mode and function calling be combined in the same agent?
Yes. An agent can use function calling for judgment-heavy or approval-sensitive steps and code mode for bounded loops, filtering, and data processing. Both paths should follow the same permission and logging controls.
7. Does code mode remove the need for a governed context or data layer?
No. Code mode changes how tools are invoked, not the quality of the information they return. Both patterns still need approved definitions, current sources, scoped permissions, quality signals, ownership, and lineage.
8. What happens to observability and human oversight in code mode?
Some intermediate values remain within the sandbox rather than appearing in the model transcript. The runtime should therefore record generated code, tool calls, approvals, errors, and selected outputs, while preserving human approval before sensitive actions.
Sources
- Code execution with MCP: building more efficient agents, Anthropic Engineering, 2025. https://www.anthropic.com/engineering/code-execution-with-mcp
- Code Mode: give agents an entire API in 1,000 tokens, Cloudflare, 2026. https://blog.cloudflare.com/code-mode-mcp/
- Code execution with MCP, Simon Willison, 2025. https://simonwillison.net/2025/Nov/4/code-execution-with-mcp/
- Anthropic Turns MCP Agents Into Code First Systems, MarkTechPost, 2025. https://www.marktechpost.com/2025/11/08/anthropic-turns-mcp-agents-into-code-first-systems-with-code-execution-with-mcp-approach/
- Cloudflare Launches Code Mode MCP Server, InfoQ, 2026. https://www.infoq.com/news/2026/04/cloudflare-code-mode-mcp-server/
